When Deserialization Meets eval(): Anatomy of a Full-Stack Compromise
Feb 26 · 5 min read · Security incidents rarely hinge on a single catastrophic bug. More often, they emerge from layered design shortcuts — each individually survivable, but collectively fatal. This case study examines a r
Join discussion
DLL Search Order Abuse: Privilege Escalation, and EDR Unhooking
Feb 18 · 7 min read · Introduction Modern enterprise environments rely heavily on third-party and internally developed applications to support daily operations. These applications frequently depend on Dynamic Link Libraries (DLLs) to load required functionality at runtime...
Join discussionLinux Special Permissions: SUID, SGID, and Sticky Bit Explained
Feb 15 · 14 min read · Introduction Beyond the standard read, write, and execute permissions we use daily, Linux has three special permission bits that provide advanced access control: SUID (Set User ID), SGID (Set Group ID), and the Sticky Bit. These special permissions s...
Join discussionMadness - Joker CTF x Steganography (TryHackMe)
Feb 3 · 6 min read · Introduction This challenge demonstrates a multi-stage attack involving web enumeration, steganography, and privilege escalation. The box requires discovering hidden content through careful reconnaissance, extracting credentials from an image file, a...
Join discussion
Conquering TryHackMe's:Rabbit_store
Jan 21 · 12 min read · Description: Rabbit Store is medium level machine from tryhackme to test your basic web testing skills and linux basics. it can be conquered if u have understanding of SSRF and SSTI vulnerabilities to achive RCEgain access to shell. Therefore, retrie...
Join discussion
Reverse Account Takeover via Email Rebinding Causing Forced Privilege De-Escalation
Jan 16 · 4 min read · When we talk about account takeover, we usually imagine a familiar story: an attacker steals credentials, hijacks a session, or abuses password reset flows to log in as someone else. This write-up is about something more subtle — and arguably more da...
Join discussion
Challenge: Tokyo Ghoul (TryHackMe)
Jan 15 · 9 min read · Introduction Tokyo Ghoul CTF Challenge - A Complete Walkthrough This write-up documents my journey through the "Tokyo Ghoul" room on TryHackMe, a beginner-to-intermediate level capture-the-flag challenge inspired by the popular anime series. This roo...
Join discussion
We're Teaching AI Agents to Be Perfect Attackers
Jan 14 · 7 min read · The security industry has spent decades building defensive models around a simple premise: humans are the weakest link. We've constructed elaborate frameworks to limit what users can access, when they can access it, and how their actions are logged. ...
Join discussion